Skip to content

Add self hosted runner for Github actions #14063

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
PasanT9 wants to merge 2 commits into
base: master
Choose a base branch
from
+3 −3
Open

Add self hosted runner for Github actions #14063

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
df216d3
Add self hosted runner for Github actions
PasanT9 Mar 22, 2026
41527ef
Merge branch 'master' into 470-30
PasanT9 Apr 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/maven.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ concurrency:
cancel-in-progress: true
jobs:
build:
runs-on: ubuntu-latest
runs-on: codebuild-wso2_product-apim-${{ github.run_id }}-${{ github.run_attempt }}
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Mar 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Block untrusted PR code from self-hosted runners.

Line 15, Line 73, and Line 102 now run pull_request workloads on self-hosted CodeBuild runners. That allows untrusted PR code (especially fork PRs) to execute on your infrastructure.

🔒 Suggested guard for fork PRs 
 jobs:
   build:
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false }}
     runs-on: codebuild-wso2_product-apim-${{ github.run_id }}-${{ github.run_attempt }}
@@
   run-benchmark-test:
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false }}
     runs-on: codebuild-wso2_product-apim-${{ github.run_id }}-${{ github.run_attempt }}
@@
   show-report:
-    if: ${{ always() && !cancelled() }}
+    if: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false) && always() && !cancelled() }}
     needs: build
     runs-on: codebuild-wso2_product-apim-${{ github.run_id }}-${{ github.run_attempt }}

Also applies to: 73-73, 102-102

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/maven.yml at line 15, The workflow currently sets runs-on
to a self-hosted CodeBuild runner (the runs-on entry) which allows untrusted PR
code to run on your infra; update the workflow so that pull_request events (fork
PRs) never use the self-hosted runner by adding a conditional that detects PRs
(e.g., checking github.event_name or github.event.pull_request.head.repo.fork)
and selects a safe runner for those cases, ensuring the runs-on assignment for
the jobs referenced by the existing runs-on line (and the other two occurrences
at the same pattern) uses the self-hosted runner only for trusted events (push
to protected branches or workflow_dispatch) and falls back to a GitHub-hosted
runner for untrusted PRs.

strategy:
matrix:
include:
Expand Down Expand Up @@ -70,7 +70,7 @@ jobs:
with:
flags: integration_tests
run-benchmark-test:
runs-on: ubuntu-latest
runs-on: codebuild-wso2_product-apim-${{ github.run_id }}-${{ github.run_attempt }}
steps:
- name: Run hostname
run: hostname
Expand Down Expand Up @@ -99,7 +99,7 @@ jobs:
show-report:
if: ${{ always() && !cancelled() }}
needs: build
runs-on: 'ubuntu-latest'
runs-on: codebuild-wso2_product-apim-${{ github.run_id }}-${{ github.run_attempt }}
steps:
- uses: actions/download-artifact@v4
with:
Expand Down
Loading